time-holiday-check

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs point to an untrusted third‑party site that hosts a downloadable executable script (call.mjs) which the README explicitly tells you to curl and run — downloading and executing remote code from an unverified domain is high risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly supports paid calls that require signing an authorization with a private key and spending USDC on Base. The docs show exporting FITTINGS_PRIVATE_KEY and running node call.mjs to pay, describe off-chain signing and a facilitator settling gas, and reference EVM/evm libraries — i.e., the skill can be used to initiate real crypto payments. This is direct financial execution capability (wallet/private-key signing to spend funds).